New “Quad9” DNS service blocks malicious domains for everyone

November 16, 2017 – 5:16 PM

The Global Cyber Alliance (GCA)—an organization founded by law enforcement and research organizations to help reduce cyber-crime—has partnered with IBM and Packet Clearing House to launch a free public Domain Name Service system. That system is intended to block domains associated with botnets, phishing attacks, and other malicious Internet hosts—primarily targeted at organizations that don’t run their own DNS blacklisting and whitelisting services. Called Quad9 (after the Internet Protocol address the service has obtained), the service works like any other public DNS server (such as Google’s), except that it won’t return name resolutions for sites that are identified via threat feeds the service aggregates daily.

“Anyone anywhere can use it,” said Phil Rettinger, GCA’s president and chief operating officer, in an interview with Ars. The service, he says, will be “privacy sensitive,” with no logging of the addresses making DNS requests—”we will keep only [rough] geolocation data,” he said, for the purposes of tracking the spread of requests associated with particular malicious domains. “We’re anonymizing the data, sacrificing on the side of privacy.”

Intelligence on malicious domains comes from 19 threat feeds—one of which is IBM’s X-Force. Adnan Baykal, GCA’s Chief Technical Advisor, told Ars that the service pulls in these threat feeds in whatever format they are published in, and it converts them into a database that is then de-duplicated. Quad9 also generates a whitelist of domains never to block; it uses a list of the top one million requested domains. During development, Quad9 used Alexa, but now that Alexa’s top million sites list is no longer being maintained, Baykal said that GCA and its partners had to turn to an alternative source for the data—the Majestic Million daily top-million sites feed.

There’s also a “gold list”—domains that should never be blocked, such as major Internet service sites like Microsoft’s Azure cloud, Google, and Amazon Web Services. “We do realize that is hosting phishing attacks,” Baykal said. “But because this is DNS filtering, we cannot block that URL specifically. And we don’t ever want to completely block Google.”

The blocked sites, whitelist, and gold lists are then converted into a Response Policy Zone (RPZ) format before being pushed out to the clusters of DNS servers around the world maintained by Packet Clearing House via DNS zone transfers. The DNS server clusters, which are each load-balanced with dnsdist, use a mix of Unbound and PowerDNS servers to deliver responses. “We’re running two different variants behind a load balancer,” Baykal said, “so that if there’s an issue with one we can take it down, or if there’s a critical vulnerability, we can shut one down and patch it.”


Google Just Made Gmail the Most Secure Email Provider on the Planet

October 18, 2017 – 10:57 AM

Anyone with a Gmail account can now activate what the company calls “Advanced Protection,” a set of features that make it harder to hack into your Google account. These are aimed specifically at “high-risk” users, as Google puts it. That is political campaign staffers, activists, journalists, or people in abusive relationships.

The main advantage in terms of security is the need for a key or token to log in as the second factor, instead of a code sent via SMS or via app. This is much better because there’s no way for hackers to steal or phish this key from afar (there have been isolated incidents of hackers using social engineering to gain access to someone’s cell phone number by getting the provider to issue a new SIM card, for instance).

Thanks to these new features, Gmail is now the most secure email provider available on the internet if you are worried about hackers breaking into your private correspondence.


KRACK Attack Devastates Wi-Fi Security

October 16, 2017 – 10:36 AM

A devastating weakness plagues the WPA2 protocol used to secure all modern Wi-Fi networks, and it can be abused to decrypt traffic from enterprise and consumer networks with varying degrees of difficulty.

Not only can attackers peek at supposedly encrypted traffic to steal credentials and payment card data, for example, but in some setups, a third party could also inject malicious code or manipulate data on the wireless network.

Some vendors have already issued security updates and users are advised to patch immediately. U.S. CERT has published a list of affected vendors, but users should note the list is not comprehensive.


How to use Let’s Encrypt to secure your websites

September 19, 2017 – 5:11 AM

Securing your business website with HTTPS isn’t just a good idea, it’s a necessity. Google Chrome now marks HTTP payment and login pages and search pages as insecure if they’re not using HTTPS. Fortunately, Let’s Encrypt makes it both free and easy to lock down your websites.

After countless website security attacks, the Internet Security Research Group (ISRG) started the Let’s Encrypt project in 2015 to make it easy for everyone to secure their websites.

The ISRG’s members includes Akamai, Cisco, Electronic Frontier Foundation (EFF), and Mozilla; the group is managed by The Linux Foundation. The group’s purpose with Let’s Encrypt is to provide free, automated, and open security certificate authority (CA) for everyone’s benefit. Let’s Encrypt enables website owners to obtain security certificates within minutes, enabling a safer web experience for all.

As ISRG executive director Josh Aas said when the group was founded, “Encryption should be the default for the web. The web is a complicated place these days; it’s difficult for consumers to be in control of their data. The only reliable strategy for making sure that everyone’s private data and information is protected while in transit over the web is to encrypt everything.”

It worked. Two years after Let’s Encrypt issued its first certificate, it has today issued more than 100 million certificates. Indeed, Let’s Encrypt is now the biggest CA of them all.

So how can you use it to protect your website?


Hackers backdoored CCleaner for a month: Over 2 million infected with malware

September 18, 2017 – 9:51 AM

Hackers backdoored the popular CCleaner Windows utility; for nearly a month, two malware-tainted versions collected computer names, IP addresses, lists of installed and active software as well lists of network adapters before sending the data to attacker’s server.

Cisco Talos, which discovered the malware on September 13 while a customer was beta testing new exploit detection technology, warned that the tainted versions of CCleaner were being distributed for nearly a month. CCleaner 5.33 was released on August 15 and a newer version without compromised code wasn’t released until September 12. A cloud version released in August was similarly infected.